We need to store some keys in a secure fashion without increment the solution complexity. After seeing the solution in #2980072, that I think is ok, I propose another way based in hash_salt as an encryption key. Hash salt is used how a secure key to one time links, hash passwords, etc and can be protected to not be stored in settings.php.
We can see in default settings.php that:
/**
* Salt for one-time login links, cancel links, form tokens, etc.
*
* This variable will be set to a random value by the installer. All one-time
* login links will be invalidated if the value is changed. Note that if your
* site is deployed on a cluster of web servers, you must ensure that this
* variable has the same value on each server.
*
* For enhanced security, you may set this variable to the contents of a file
* outside your document root; you should also ensure that this file is not
* stored with backups of your database.
*
* Example:
* @code
* $settings['hash_salt'] = file_get_contents('/home/example/salt.txt');
* @endcode
*/
$settings['hash_salt'] = 'aaaaaa';
I think that if hash_salt is compromised, all the system is lost. Then, we can base on it how to secure data, because Drupal has it how as a secure point.
| Comment | File | Size | Author |
|---|---|---|---|
| #9 | secure_configuration_key_provider_3028014_8.patch | 4.26 KB | psf_ |
Comments
Comment #2
psf_ commentedComment #3
psf_ commentedThis patch requires php openssl module enabled, Need I add to composer.json how a requirement?
The encryption method used is 'aes-256-cbc'.
Comment #4
psf_ commentedComment #6
psf_ commentedComment #7
psf_ commentedComment #9
psf_ commentedNow? :_ D
Comment #10
psf_ commentedComment #11
manuel garcia commentedI'm not entirely sure this is a safe thing to do, my concerns:
Comment #12
psf_ commentedYes and yes :D
1.- It's used to protect user password too if you change it, all your users will be lost their passwords.
2.- The salt it's your castle key, if you lost it, you lost all. (it's an exaggeration)
I think that the information stored in "key" module don't must be unique, it must be recuperable by other channels too. I see this how a server to server connection credential storage, for example. With the correct user alert about this may be a good solution.
Comment #13
psf_ commentedI created a new module with this functionality: Fuzzy Config Key Provider.
Comment #14
imclean commented#12
Comment #15
rlhawkClosing this, since a separate module now provides the requested functionality.